Oracle Application Express
Oracle Application Express is a web-based software development environment that runs on an Oracle database. It is fully supported and comes standard with all Oracle Database editions and, starting with Oracle 11g, is installed by default as part of the core database install.
APEX can be used to build complex web applications which can be used in most modern web browsers. The APEX development environment is also browser-based.
Releases
Oracle Application Express can be installed on any Oracle database from version 9.2 or higher, and starting from Oracle 11g it is installed with the database by default. APEX 4.0 and higher can be installed on an Oracle 10.2.0.3 or higher database. APEX 5.0 and higher can be installed on all editions of the Oracle database, 11.1.0.7 or higher with a valid Oracle Database Technical Support agreement; it can also be used with Oracle Database 11g Express Edition, but is supported through the Oracle Technology Network discussion forum, and not through Oracle Support Services.| Product Name | Version | Released | Notes | - |
| HTML DB | 1.5 | 2004 | First release. | - |
| HTML DB | 1.6 | 2004 | Added themes. | - |
| HTML DB | 2.0 | 2005 | Added SQL Workshop. | - |
| Application Express | 2.1 | January 2006 | HTMLDB was renamed to APEX. Version 2.1 of APEX was bundled with the free Oracle Express Edition database. | - |
| Application Express | 2.2 | 2006 | Packaged Applications. | - |
| Application Express | 3.0 | 2007 | This version featured several new features, including PDF Printing, Flash charting and Access Application Migration. | - |
| Application Express | 3.0.1 | July 2007 | This version could also be installed into an Oracle XE database. | - |
| Application Express | 3.1 | Spring 2008 | This included a new major feature known as Interactive Reporting. Also added support for BLOB data type. | - |
| Application Express | 3.2 | 2009 | Forms conversion. | - |
| Application Express | 4.0 | June 2010 | Some notable features are declarative Dynamic Actions and Plugins. Also added Websheets and RESTful Web. | - |
| Application Express | 4.1 | August 2011 | Notable new features included improved error handling, use of ROWID for updates, a data upload feature for end-users, and improved WebSheets. | - |
| Application Express | 4.1.1 | February 2012 | Notable new features included new theme and various templates. | - |
| Application Express | 4.2 | October 2012 | Notable new features such as application builder for mobile, mobile and responsive themes, and HTML5 support. | - |
| Application Express | 4.2.1 | December 2012 | Bug Fixes. | - |
| Application Express | 4.2.2 | April 2013 | Bug Fixes, Improved PDF printing, new Survey Builder packaged application. | - |
| Application Express | 4.2.3 | September 2013 | This is a cumulative patch set for Application Express 4.2.0, Application Express 4.2.1, and Application Express 4.2.2. | - |
| Application Express | 4.2.4 | December 2013 | This is a cumulative patch set for Application Express 4.2.0, Application Express 4.2.1, Application Express 4.2.2 and Application Express 4.2.3. | - |
| Application Express | 4.2.5 | April 2014 | This is a cumulative patch set for Application Express 4.2.0, Application Express 4.2.1, Application Express 4.2.2, Application Express 4.2.3 and Application Express 4.2.4. | - |
| Application Express | 4.2.6 | September 2014 | This is a cumulative patch set for Application Express 4.2.0, Application Express 4.2.1, Application Express 4.2.2, Application Express 4.2.3, Application Express 4.2.4 and Application Express 4.2.5. | - |
| Application Express | 5.0 | April 2015 | Notable features are focused on developer productivity and improving the User Interface of user applications. This version introduces Page Designer, a browser-based IDE which provides drag and drop layouting of page components, property editor, and much more, reducing the need to go from page to page to make changes. Version 5.0 also introduces Universal Theme, a responsive user interface for user applications which can easily and extensively be customized using Template Options and Theme Roller. | - |
| Application Express | 5.0.1 | July 2015 | This is a cumulative patch set for Application Express 5.0.0. | - |
| Application Express | 5.0.2 | October 2015 | This is a cumulative patch set for Application Express 5.0.0 and Application Express 5.0.1. | - |
| Application Express | 5.0.3 | December 2015 | Application Express 5.0.3. | - |
| Application Express | 5.0.4 | July 2016 | This is a cumulative patch set for Application Express 5.0.0 and Application Express 5.0.3 | - |
| Application Express | 5.1 | December 2016 | Notable features include a new "Interactive Grids" component which provides an editable grid, Oracle JET-based charting, updated Universal Theme with Live Template Options and RTL support, several UX enhancements, updates to Packaged Apps, and three new Productivity Apps: Quick SQL, REST Client Assistant, and Competitive Analysis. | - |
| Application Express | 5.1.1 | March 2017 | This is a cumulative patch set for Application Express 5.1.0 | - |
| Application Express | 5.1.2 | June 2017 | This is a cumulative patch set for Application Express 5.1.0 and Application Express 5.1.1 | - |
| Application Express | 5.1.3 | September 2017 | This is a cumulative patch set for Application Express 5.1.0 - Application Express 5.1.2 | - |
| Application Express | 5.1.4 | December 2017 | This is a cumulative patch set for Application Express 5.1.0 - Application Express 5.1.3 | - |
| Application Express | 18.1.0 | May 2018 | Oracle has released the latest version of APEX and keeping in line with their naming convention Apex has jumped from version 5.1.4 to 18.1- Application Express 5.1.4 | |
| Application Express | 18.2.0 | September 2018 | reworking of "Create Page" wizard, ability to upgrade Font APEX, sample data sets enhanced with other languages. | |
| Application Express | 19.1.0 | March 2019 | Bug fixes, new features like REST-Enabled Forms, Dark Mode, Form Component, updated jQuery and oJet, enhanced JavaScript API, Interactive Grid, data-loading and charts | - |
| Application Express | 19.2.0.00.18 | November 2019 | Introducing Faceted Search, a new component that enables you to quickly search and filter your data like never before. Empower your users to see data in new ways, and discover new insights, effortlessly, with just a few clicks. | - |
| Application Express | 20.1.0.00.13 | April 2020 | This version includes the following features: APEX + Redwood: The user interface of APEX and the App Builder has been refreshed to align with Redwood, Oracle's new user experience design system. Faceted Search Enhancements: Allowing implement a cascading list of values, conditional facets, and compact count display Friendly URLs: The URL syntax for APEX apps has been simplified to allow for friendlier URLs at runtime. Improvements in Deployments and Exports: Automatic Backups, Export App as Zip and One-Click Remote App Deployment. Native PDF Printing: You can now print PDF files directly from Interactive Grids. Mega Menus: Render the navigation menu as a collapsible floating panel that displays all navigation items at once. | - |
Background
Application Express has gone through many name changes since its inception in 2000. Names include:- Flows
- Oracle Platform
- Project Marvel
- HTML DB
- Application Express
APEX is used internally by Oracle to develop some of its support sites. The AskTom knowledgebase and online store both run on APEX. The Metalink support site ran on APEX for some time before it was eventually replaced by an Oracle ADF solution.
Advantages and disadvantages
Advantages
- DBAs familiar with PL/SQL can use their skill set to develop web applications
- Easy to create mock-ups using pre-built themes
- Easy to deploy
- Scalable
- Server-side processing and validations
- Strong and supportive user community
- Basic support for group development
- Free hosting of demo applications provided by Oracle
- Apex applications can run on the free Oracle Express Edition database
- Individual components of an application can be retrieved or identified using SQL, facilitating customized reports
- Easily adheres to the SQA development/test/production model
- Helps put the focus on the DB model supporting a solution
- Easily supports a standardized theme across application sets
- Semi-technical end users can build their own web pages and reports
Disadvantages
- APEX applications are created using Oracle's own tools and only can be hosted in an Oracle database, making an implementer susceptible to vendor lock-in.
- Very few webhosts offer APEX on their hosting service package. As a result, APEX applications are limited in their choice of webhosts. However, since APEX can run on the free Express Edition of the Oracle database, it is possible to install the required stack on any standard operating system host.
- Projects requiring multiple developers to touch the same web page will need to communicate their intentions with each other. There is no built in version control and all components must be edited through the web interface. No support for merge two versions. Page locking can help guard against conflicts.
Low Code Environment
Security
There is a common misconception that the abstracted nature of APEX applications results in a relatively secure user environment. However, APEX applications suffer from the same classes of application security flaws as other web applications based on more direct technologies such as PHP, ASP.net and Java.The main classes of vulnerability that affect APEX applications are: SQL injection, Cross-site scripting, and Access Control.
APEX applications inherently use PL/SQL constructs as the base server-side language. As well as accessing data via PL/SQL blocks, an APEX application will use PL/SQL to implement authorization, and to conditionally display web page elements. This means that generally APEX applications suffer from SQL injection when these PL/SQL blocks do not correctly validate and handle malicious user input. Oracle implemented a special variable type for APEX called Substitution Variables and these are not safe and lead to SQL Injection. Where the injection occurs within a PL/SQL block an attacker can inject an arbitrary number of queries or statements to execute. Escaping special characters and using bind variables is the right way to code to ensure no XSS and SQL injection.
Cross-Site Scripting vulnerabilities arise in APEX applications just like other web application languages. Oracle provides the htf.escape_sc function to escape user data that is displayed within a rendered HTML response. The reports that APEX generates also provide protection against XSS through the Display As setting on report columns. Originally the default was for reports to be created without any escaping of the columns, although recent versions now set the column type to escape by default. Column definitions can be queried programmatically to check for columns that do not escape the value.
To control access to resources within an APEX application a developer can assign authorization schemes to resources. These must be applied consistently in order to ensure that resources are appropriately protected. A typical example of inconsistent access-control being applied is where an authorization scheme is set for a Button item, but not the associated Process that is performed when the button is clicked. A malicious user can perform the process without requiring the actual Button to be accessible.
Since APEX 4.0, the Application Builder interface provides some limited assessment of the security posture through the Advisor utility.